https://s-markakis.github.io/blog.html Cybersecurity research, CTF writeups, and development notes by S. Markakis. en https://s-markakis.github.io/blog.html#what-is-a-pentest https://s-markakis.github.io/blog.html#what-is-a-pentest Wed, 09 Sep 2026 00:00:00 GMT A buyer's guide for business owners: what a real pentest involves, why an automated scan report isn't one, what the deliverables are, and the questions (and red flags) before you pay. offensive security https://s-markakis.github.io/blog.html#mikrotik-capsman https://s-markakis.github.io/blog.html#mikrotik-capsman Tue, 08 Sep 2026 00:00:00 GMT Manage every access point in a hotel from one place — RouterOS 7 CAPsMAN (WifiWave2): the manager, provisioning CAPs, one config for all radios, VLAN-tagged SSIDs, seamless roaming, and the discovery gotchas. mikrotik wireless https://s-markakis.github.io/blog.html#guest-wifi-isolation https://s-markakis.github.io/blog.html#guest-wifi-isolation Mon, 07 Sep 2026 00:00:00 GMT A plain-language guide for hotel and business owners: what network segmentation is, why a Wi-Fi password protects nothing by itself, and the five things to ask your IT person for — including proof. security https://s-markakis.github.io/blog.html#mikrotik-hotspot https://s-markakis.github.io/blog.html#mikrotik-hotspot Sun, 06 Sep 2026 00:00:00 GMT A guest Wi-Fi login page done right — the hotspot, a branded terms-acceptance login, voucher codes with User Manager, RADIUS, a walled garden, per-guest bandwidth, and the HTTPS-redirect reality every hotel hits. mikrotik wireless https://s-markakis.github.io/blog.html#mikrotik-index https://s-markakis.github.io/blog.html#mikrotik-index Sat, 05 Sep 2026 00:00:00 GMT A complete, practical RouterOS course in 13 writeups — from terminal habits and backups through VLANs, firewalling, WireGuard, OSPF, and a full hotel-network lab. The MikroTik counterpart to our 27-part Cisco series. mikrotik fundamentals https://s-markakis.github.io/blog.html#htb-fireflow https://s-markakis.github.io/blog.html#htb-fireflow Fri, 04 Sep 2026 00:00:00 GMT Langflow 1.8.2 unauthenticated RCE, MCP service JWT cryptographic bypass, and a multi-stage Kubernetes escape via kubelet WebSocket exec and privileged container mounts. offensive htb https://s-markakis.github.io/blog.html#mikrotik-lab-hotel https://s-markakis.github.io/blog.html#mikrotik-lab-hotel Fri, 04 Sep 2026 00:00:00 GMT A complete hotel network on MikroTik — RB5009 gateway, CRS326 core, VLAN-tagged SSIDs, guest isolation firewall, per-VLAN DHCP, and PCQ fairness — built in order, verified, then failure-drilled. Runs on CHR too. mikrotik labs https://s-markakis.github.io/blog.html#cohort-hackthebox https://s-markakis.github.io/blog.html#cohort-hackthebox Thu, 03 Sep 2026 00:00:00 GMT Easy machine walkthrough — SSRF filter bypass via alternate IP encoding, pre-auth RCE in Marimo notebook, and a PackageKit TOCTOU race condition for root. offensive htb https://s-markakis.github.io/blog.html#htb-paperwork https://s-markakis.github.io/blog.html#htb-paperwork Thu, 03 Sep 2026 00:00:00 GMT OS command injection in a hand-rolled LPD/RFC 1179 intake service, a decorative path sanitiser in a JetDirect/PJL printer emulator, and a root daemon that leaks an open file descriptor to a root-only credential file over SCM_RIGHTS. offensive htb https://s-markakis.github.io/blog.html#mikrotik-ospf https://s-markakis.github.io/blog.html#mikrotik-ospf Wed, 02 Sep 2026 00:00:00 GMT OSPF in RouterOS 7's rebuilt routing engine — instance, area, interface-template — on a three-router topology where one router is a Cisco. Mixed-vendor adjacency, costs, default origination, and the ROS6→7 migration traps. mikrotik routing https://s-markakis.github.io/blog.html#mikrotik-wireguard https://s-markakis.github.io/blog.html#mikrotik-wireguard Mon, 31 Aug 2026 00:00:00 GMT WireGuard on RouterOS 7 from zero — road-warrior access for phone and laptop, a site-to-site tunnel between offices, the allowed-address logic everyone gets wrong, and the keepalive trick for peers behind NAT. mikrotik vpn https://s-markakis.github.io/blog.html#mikrotik-firewall https://s-markakis.github.io/blog.html#mikrotik-firewall Sat, 29 Aug 2026 00:00:00 GMT Connection tracking, a default-deny input chain that can't lock you out, a forward chain with FastTrack that doesn't break QoS, and address-list rate-limiting for brute-force — built from first principles. mikrotik security https://s-markakis.github.io/blog.html#cisco-lab-troubleshooting https://s-markakis.github.io/blog.html#cisco-lab-troubleshooting Thu, 27 Aug 2026 00:00:00 GMT A troubleshooting scenario: the part-24 campus with eight planted faults — wrong VLANs, err-disabled ports, a pruned trunk, split-brain HSRP, a missing DHCP relay, a stale NAT ACL. Diagnose each from the symptom, layer by layer. cisco labs https://s-markakis.github.io/blog.html#cisco-lab-gre-ipsec https://s-markakis.github.io/blog.html#cisco-lab-gre-ipsec Tue, 25 Aug 2026 00:00:00 GMT A hub-and-spoke WAN you can build in Packet Tracer — an ISP cloud that refuses to route your LANs, GRE tunnels that carry them anyway, OSPF over the tunnels, and IPsec encrypting the lot. cisco labs https://s-markakis.github.io/blog.html#cisco-lab-ospf-areas https://s-markakis.github.io/blog.html#cisco-lab-ospf-areas Sun, 23 Aug 2026 00:00:00 GMT Five routers, three areas — ABRs, the LSA types that matter, stub and totally-stubby areas, default-information originate, and cost tuning with a failure drill. Builds fully in Packet Tracer. cisco labs https://s-markakis.github.io/blog.html#cisco-lab-campus https://s-markakis.github.io/blog.html#cisco-lab-campus Fri, 21 Aug 2026 00:00:00 GMT A complete Packet Tracer campus build — two access switches, two L3 cores with HSRP and aligned Rapid-PVST roots, an LACP core interlink, and a NAT edge. Full topology, addressing plan, and failure drills. cisco labs https://s-markakis.github.io/blog.html#cisco-index https://s-markakis.github.io/blog.html#cisco-index Thu, 20 Aug 2026 00:00:00 GMT A complete, practical Cisco IOS course in 27 writeups — from your first console session to firewalls, redundancy, automation, and four full Packet Tracer lab scenarios. Every post cross-mapped to MikroTik. cisco fundamentals https://s-markakis.github.io/blog.html#cisco-buying-used https://s-markakis.github.io/blog.html#cisco-buying-used Wed, 19 Aug 2026 00:00:00 GMT A practical guide to buying refurbished Cisco gear for an SMB — whats safe to buy used, spotting counterfeits, the licensing and support catch, EOL/security-patch risk, and a pre-purchase checklist. cisco guides https://s-markakis.github.io/blog.html#cisco-catalyst-vs-meraki https://s-markakis.github.io/blog.html#cisco-catalyst-vs-meraki Mon, 17 Aug 2026 00:00:00 GMT Cisco Catalyst (CLI, one-time cost) or Meraki (cloud dashboard, subscription)? An honest, vendor-neutral comparison for SMBs — the licensing trap, when each wins, and what happens if you stop paying. cisco guides https://s-markakis.github.io/blog.html#cisco-ansible https://s-markakis.github.io/blog.html#cisco-ansible Sat, 15 Aug 2026 00:00:00 GMT Config as code for Cisco — Ansible with the cisco.ios collection: inventory, ios_facts, idempotent ios_config, backups, vaulted secrets, and pushing a change to every switch at once, safely with check mode. cisco automation https://s-markakis.github.io/blog.html#cisco-ipv6 https://s-markakis.github.io/blog.html#cisco-ipv6 Thu, 13 Aug 2026 00:00:00 GMT IPv6 on Cisco without the fear — address types, link-local, SLAAC vs DHCPv6, enabling routing, static routes and OSPFv3, NDP instead of ARP, and why theres no NAT. cisco fundamentals https://s-markakis.github.io/blog.html#cisco-span https://s-markakis.github.io/blog.html#cisco-span Tue, 11 Aug 2026 00:00:00 GMT Copy traffic to an analyzer without a tap — local SPAN, remote RSPAN across switches, and ERSPAN over IP on Cisco: sources, destinations, the oversubscription gotcha, and IDS/incident-response use. cisco monitoring https://s-markakis.github.io/blog.html#cisco-hardening https://s-markakis.github.io/blog.html#cisco-hardening Sun, 09 Aug 2026 00:00:00 GMT Audit and lock down any Cisco device in 15 minutes — SSH ciphers, SNMPv3, AAA, VTY access-class, control-plane policing, unused services, and the login-hardening checklist we run on every box. cisco security https://s-markakis.github.io/blog.html#cisco-8021x https://s-markakis.github.io/blog.html#cisco-8021x Fri, 07 Aug 2026 00:00:00 GMT Authenticate devices before they get network access — 802.1X with RADIUS on Cisco switches: supplicant/authenticator/server roles, dot1x config, MAB fallback, dynamic VLANs, and open-mode rollout. cisco security https://s-markakis.github.io/blog.html#cisco-eem https://s-markakis.github.io/blog.html#cisco-eem Wed, 05 Aug 2026 00:00:00 GMT Make the router fix itself — Embedded Event Manager applets that react to syslog, timers, and track state: auto-recover err-disabled ports, back up config on change, and alert on events. cisco automation https://s-markakis.github.io/blog.html#htb-nexus https://s-markakis.github.io/blog.html#htb-nexus Tue, 04 Aug 2026 00:00:00 GMT HackTheBox Nexus machine walkthrough — leaked Gitea commit credentials into an authenticated Krayin CRM file-upload RCE, a leaked .env password reused over SSH, and an automated exploit for a Gitea template-sync path traversal that plants a root SSH key. offensive htb https://s-markakis.github.io/blog.html#htb-abducted https://s-markakis.github.io/blog.html#htb-abducted Tue, 04 Aug 2026 00:00:00 GMT HackTheBox Abducted machine walkthrough — unauthenticated RCE via a Samba print-spooler %J injection (CVE-2026-4480), credential recovery from an rclone config, SMB symlink key injection, and a systemd drop-in to root. offensive htb https://s-markakis.github.io/blog.html#cisco-ios-upgrade https://s-markakis.github.io/blog.html#cisco-ios-upgrade Mon, 03 Aug 2026 00:00:00 GMT Upgrade a Cisco switch or router without bricking it — check space, verify the image hash, set boot variables, and the difference between classic bundle boot and IOS-XE install mode, with a rollback plan. cisco fundamentals https://s-markakis.github.io/blog.html#cisco-observability https://s-markakis.github.io/blog.html#cisco-observability Sat, 01 Aug 2026 00:00:00 GMT You cant troubleshoot what you didnt record — synchronized time with NTP, centralized logs with syslog, monitoring with SNMPv3, and traffic visibility with Flexible NetFlow on Cisco IOS. cisco monitoring https://s-markakis.github.io/blog.html#detecting-cisco-attacks https://s-markakis.github.io/blog.html#detecting-cisco-attacks Fri, 31 Jul 2026 00:00:00 GMT The blue-team companion to the offensive post — the syslog, NetFlow, and config-change signatures that catch Smart Install/SNMP config theft, DTP/VTP Layer-2 abuse, recon/brute force, and post-compromise changes on Cisco gear. cisco security monitoring https://s-markakis.github.io/blog.html#detecting-mikrotik-attacks https://s-markakis.github.io/blog.html#detecting-mikrotik-attacks Fri, 31 Jul 2026 00:00:00 GMT The defender's half of the RouterOS offensive post — off-box detection via the account log topic, Traffic-Flow, and baseline diffing to catch Winbox exploitation, brute force, config exfil/pivoting, and the persistence an attacker leaves behind. mikrotik security monitoring https://s-markakis.github.io/blog.html#arch-index https://s-markakis.github.io/blog.html#arch-index Fri, 31 Jul 2026 00:00:00 GMT Design-level network architecture — campus topologies, segmentation, WAN and edge, spine-leaf fabrics, perimeter/DMZ, zero trust, out-of-band management, resilience, and SMB reference designs. The why and when above the how. architecture https://s-markakis.github.io/blog.html#arch-campus-topologies https://s-markakis.github.io/blog.html#arch-campus-topologies Fri, 31 Jul 2026 00:00:00 GMT The campus/DC topology decision — when a collapsed core, a three-tier hierarchy, or a spine-leaf fabric each wins, traded on device count, failure domain, and bandwidth predictability, with a one-table decision guide. cisco mikrotik architecture https://s-markakis.github.io/blog.html#arch-segmentation https://s-markakis.github.io/blog.html#arch-segmentation Fri, 31 Jul 2026 00:00:00 GMT How to design segmentation before you configure it — enumerate trust zones by blast-radius, build a default-deny inter-zone matrix, pick the right enforcement per boundary, and address/name it so the design survives. architecture security https://s-markakis.github.io/blog.html#arch-wan-overlays https://s-markakis.github.io/blog.html#arch-wan-overlays Fri, 31 Jul 2026 00:00:00 GMT Choosing the multi-site WAN shape — centralised hub-and-spoke, fast-but-quadratic full mesh, or controller-brokered SD-WAN — and why dynamic-shortcut overlays give much of SD-WAN's benefit without the subscription. cisco mikrotik architecture https://s-markakis.github.io/blog.html#arch-multihomed-edge https://s-markakis.github.io/blog.html#arch-multihomed-edge Fri, 31 Jul 2026 00:00:00 GMT Designing a resilient internet edge — provider-assigned dual-WAN vs provider-independent BGP, active/backup vs active/active, and where NAT/CGNAT belongs (including the double-NAT and Starlink-CGNAT traps). mikrotik architecture https://s-markakis.github.io/blog.html#arch-spine-leaf-vxlan https://s-markakis.github.io/blog.html#arch-spine-leaf-vxlan Fri, 31 Jul 2026 00:00:00 GMT The modern DC/large-campus fabric demystified — a routed ECMP spine-leaf underlay, a VXLAN overlay floating Layer-2 tenants on Layer-3, and EVPN as the BGP control plane that makes it scale. cisco architecture https://s-markakis.github.io/blog.html#arch-perimeter-dmz https://s-markakis.github.io/blog.html#arch-perimeter-dmz Fri, 31 Jul 2026 00:00:00 GMT Where internet-facing services should live — three-legged vs screened-subnet firewall placement, the load-bearing DMZ-to-LAN deny rule, east-west discipline inside the DMZ, and safe publishing patterns. architecture security https://s-markakis.github.io/blog.html#arch-zero-trust https://s-markakis.github.io/blog.html#arch-zero-trust Fri, 31 Jul 2026 00:00:00 GMT Zero trust minus the marketing — never trust location, least privilege, assume breach — as identity-driven microsegmentation, and how to capture the 80/20 on Cisco/MikroTik you already own instead of a ZTNA platform. architecture security https://s-markakis.github.io/blog.html#arch-oob-management https://s-markakis.github.io/blog.html#arch-oob-management Fri, 31 Jul 2026 00:00:00 GMT Why you can't fix a down network over the down network — designing an isolated management plane, console-server access to a box with no IP, and an independent recovery uplink, for resilience and security. architecture security https://s-markakis.github.io/blog.html#arch-designing-for-failure https://s-markakis.github.io/blog.html#arch-designing-for-failure Fri, 31 Jul 2026 00:00:00 GMT A systematic SPOF audit across power, links, devices, WAN, protocols and services — matching redundancy to the cost of downtime, testing failover by causing failure, and the single points everyone forgets. architecture https://s-markakis.github.io/blog.html#arch-smb-reference https://s-markakis.github.io/blog.html#arch-smb-reference Fri, 31 Jul 2026 00:00:00 GMT Proven small-business blueprints — the common skeleton (collapsed-core, dual-WAN, six zones) plus the trade-specific twist for a hotel, a clinic, and a professional office, distilled from real builds. architecture https://s-markakis.github.io/blog.html#cisco-wireless-ap https://s-markakis.github.io/blog.html#cisco-wireless-ap Thu, 30 Jul 2026 00:00:00 GMT Controller-based Cisco wireless — how a lightweight AP discovers and joins a WLC over CAPWAP (DHCP option 43/DNS/broadcast), the Catalyst 9800 tag model for configuring the whole fleet, FlexConnect for branches, and VLAN-per-SSID. cisco wireless https://s-markakis.github.io/blog.html#mikrotik-ap https://s-markakis.github.io/blog.html#mikrotik-ap Thu, 30 Jul 2026 00:00:00 GMT A single RouterOS AP done right with the wifiwave2 stack — WPA3 transitional security, multiple SSIDs each tagged to its own VLAN, guest client-isolation, and the standalone-vs-CAPsMAN decision that mirrors Cisco autonomous-vs-lightweight. mikrotik wireless https://s-markakis.github.io/blog.html#mikrotik-lab-ospf-areas https://s-markakis.github.io/blog.html#mikrotik-lab-ospf-areas Thu, 30 Jul 2026 00:00:00 GMT Five RouterOS 7 routers across three areas — ABRs via interface-templates, a stub area, the LSA types that matter proven by inspection, and the every-area-touches-the-backbone and MTU-mismatch traps. mikrotik labs https://s-markakis.github.io/blog.html#mikrotik-lab-wan https://s-markakis.github.io/blog.html#mikrotik-lab-wan Thu, 30 Jul 2026 00:00:00 GMT An encrypted, dynamically-routed branch WAN on RouterOS 7 — GRE tunnels carrying OSPF, IPsec via the GRE ipsec-secret one-liner, the protocol-47/MTU gotchas, and passive-LAN/ptp-tunnel hygiene. mikrotik labs https://s-markakis.github.io/blog.html#mikrotik-lab-troubleshooting https://s-markakis.github.io/blog.html#mikrotik-lab-troubleshooting Thu, 30 Jul 2026 00:00:00 GMT Seven realistic RouterOS faults dressed as support tickets — a missing bridge VLAN member, scoped masquerade, OSPF MTU mismatch, DHCP bound to the wrong interface, FastTrack bypassing a rule, per-packet routing-marks splitting flows, and offload killed by a bridge feature — each with the command that finds it. mikrotik labs https://s-markakis.github.io/blog.html#cisco-dmvpn https://s-markakis.github.io/blog.html#cisco-dmvpn Thu, 30 Jul 2026 00:00:00 GMT Scale a branch WAN without a full mesh — mGRE + NHRP + IPsec, a hub you configure once, dynamic spoke registration, and Phase-3 direct spoke-to-spoke tunnels, with the NBMA-vs-tunnel and routing gotchas. cisco vpn https://s-markakis.github.io/blog.html#mikrotik-dmvpn https://s-markakis.github.io/blog.html#mikrotik-dmvpn Thu, 30 Jul 2026 00:00:00 GMT RouterOS has no DMVPN — build the scalable equivalent with a WireGuard hub-and-spoke: one peer per spoke on the hub, OSPF over the overlay, the allowed-address cryptokey-routing trap, and what you trade versus DMVPN's on-demand spoke-to-spoke. mikrotik vpn https://s-markakis.github.io/blog.html#cisco-remote-access-vpn https://s-markakis.github.io/blog.html#cisco-remote-access-vpn Thu, 30 Jul 2026 00:00:00 GMT Road-warrior access on IOS — IKEv2/FlexVPN with an authorization policy pushing the client's address, DNS and split-tunnel routes, a virtual-template per client, the server-certificate trust requirement, and an SSL fallback. cisco vpn https://s-markakis.github.io/blog.html#mikrotik-remote-access-vpn https://s-markakis.github.io/blog.html#mikrotik-remote-access-vpn Thu, 30 Jul 2026 00:00:00 GMT Get laptops and phones securely back to the office on RouterOS — SSTP over TLS/443 for hostile firewalls, IKEv2 with mode-config for native clients, generate-policy and server-cert gotchas, plus the firewall/NAT rules people forget. mikrotik vpn https://s-markakis.github.io/blog.html#cisco-eigrp https://s-markakis.github.io/blog.html#cisco-eigrp Thu, 30 Jul 2026 00:00:00 GMT Cisco's advanced distance-vector protocol — named-mode config, the successor/feasible-successor logic behind sub-second failover, unequal-cost load balancing with variance, summarisation, and why it's effectively Cisco-only. cisco routing https://s-markakis.github.io/blog.html#cisco-redistribution-bfd https://s-markakis.github.io/blog.html#cisco-redistribution-bfd Thu, 30 Jul 2026 00:00:00 GMT Glue OSPF, BGP, EIGRP and static together safely — seed metrics and the subnets/E1-vs-E2 traps, tag-and-deny loop prevention, administrative-distance pitfalls, and BFD for millisecond failure detection. cisco routing https://s-markakis.github.io/blog.html#mikrotik-redistribution-bfd https://s-markakis.github.io/blog.html#mikrotik-redistribution-bfd Thu, 30 Jul 2026 00:00:00 GMT RouterOS 7 redistribution through the filter-chain model — per-protocol toggle plus a mandatory output chain, tag-and-reject loop prevention, administrative distance, and version-dependent BFD for fast, stable failover. mikrotik routing https://s-markakis.github.io/blog.html#cisco-bgp-dual-isp https://s-markakis.github.io/blog.html#cisco-bgp-dual-isp Thu, 30 Jul 2026 00:00:00 GMT Run a real multihomed BGP edge on Cisco IOS — two eBGP upstreams, outbound path control with local-preference, inbound with AS-path prepend, mandatory anti-transit filtering, and automatic failover. cisco routing https://s-markakis.github.io/blog.html#mikrotik-bgp-dual-isp https://s-markakis.github.io/blog.html#mikrotik-bgp-dual-isp Thu, 30 Jul 2026 00:00:00 GMT RouterOS 7 rewrote BGP — build a dual-ISP edge the v7 way with /routing bgp connection and /routing filter chains: two upstreams, local-preference and prepend path control, anti-transit filters, and automatic failover. mikrotik routing https://s-markakis.github.io/blog.html#cisco-pbr https://s-markakis.github.io/blog.html#cisco-pbr Thu, 30 Jul 2026 00:00:00 GMT Route by who sent the packet, not just where it's going — PBR route-maps that steer a subnet or application out a different next-hop, the set-clause differences, and pairing with IP SLA so a dead path never blackholes. cisco routing https://s-markakis.github.io/blog.html#mikrotik-routing-rules https://s-markakis.github.io/blog.html#mikrotik-routing-rules Thu, 30 Jul 2026 00:00:00 GMT RouterOS's two policy-routing tools — lightweight routing rules and connection-aware mangle routing-marks — when to use which, the connection-mark-then-routing-mark pattern that keeps a flow pinned to one WAN, and per-WAN NAT. mikrotik routing https://s-markakis.github.io/blog.html#cisco-netconf https://s-markakis.github.io/blog.html#cisco-netconf Thu, 30 Jul 2026 00:00:00 GMT Talk to modern IOS-XE like an API — YANG-modelled config over NETCONF and RESTCONF, a curl RESTCONF quick-win, transactional NETCONF edits with a candidate datastore via ncclient, and when this beats CLI/Ansible. cisco automation https://s-markakis.github.io/blog.html#mikrotik-containers https://s-markakis.github.io/blog.html#mikrotik-containers Thu, 30 Jul 2026 00:00:00 GMT Run OCI/Docker images on the router itself — the device-mode security gate, veth networking on an isolated bridge, pulling and running a container (Pi-hole), persistence with mounts, and the architecture/storage constraints. mikrotik automation https://s-markakis.github.io/blog.html#mikrotik-prometheus https://s-markakis.github.io/blog.html#mikrotik-prometheus Thu, 30 Jul 2026 00:00:00 GMT Time-series metrics and dashboards for RouterOS — a read-only API user, the mktxp exporter (optionally in a container on the router), a Prometheus scrape job, and Grafana dashboards with alerts on BGP/WAN/CPU/queues. mikrotik monitoring https://s-markakis.github.io/blog.html#field-audit-hotel-group https://s-markakis.github.io/blog.html#field-audit-hotel-group Thu, 30 Jul 2026 00:00:00 GMT An anonymised security audit across three small family hotels — a flat network with guests on the same wire as the booking PC and cameras, an exposed router management plane, and the guest-to-card-data finding that got remediation approved the same afternoon. mikrotik offensive security https://s-markakis.github.io/blog.html#cisco-vs-mikrotik https://s-markakis.github.io/blog.html#cisco-vs-mikrotik Thu, 30 Jul 2026 00:00:00 GMT The same network task in Cisco IOS and MikroTik RouterOS side by side, grouped by topic, each row linking the full twin post on both platforms — a jump table for a mixed estate. cisco mikrotik https://s-markakis.github.io/blog.html#mikrotik-first-contact https://s-markakis.github.io/blog.html#mikrotik-first-contact Thu, 30 Jul 2026 00:00:00 GMT Your first ten minutes with a new RouterOS device — WinBox and MAC-connect, the default configuration and how to read it, identity, users, addressing, and a safe way back if you lock yourself out. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-hardening https://s-markakis.github.io/blog.html#mikrotik-hardening Thu, 30 Jul 2026 00:00:00 GMT Lock down a RouterOS box properly — disable the services you don't use, an input-chain firewall that protects the router itself, real user accounts, SSH strong crypto, neighbour-discovery and MAC-server exposure, and the Winbox port you must never leave on the internet. mikrotik security https://s-markakis.github.io/blog.html#mikrotik-dhcp-nat https://s-markakis.github.io/blog.html#mikrotik-dhcp-nat Thu, 30 Jul 2026 00:00:00 GMT Hand out addresses and share one public IP — an IP pool, a DHCP server with reservations, masquerade vs src-nat, and the connection-tracking model that makes RouterOS NAT behave the way it does. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-port-security https://s-markakis.github.io/blog.html#mikrotik-port-security Thu, 30 Jul 2026 00:00:00 GMT Stop Layer-2 abuse on RouterOS — bridge port isolation with horizon, DHCP snooping and trusted ports, bridge filtering, MAC limits, and why hardware offload changes which of these actually run on the switch chip. mikrotik security switching https://s-markakis.github.io/blog.html#mikrotik-stp-bonding https://s-markakis.github.io/blog.html#mikrotik-stp-bonding Thu, 30 Jul 2026 00:00:00 GMT Loop prevention and link aggregation on RouterOS — RSTP/MSTP bridge modes, root-bridge and port cost, and 802.3ad LACP bonding to double a link between switches without a loop. mikrotik switching https://s-markakis.github.io/blog.html#mikrotik-vrrp https://s-markakis.github.io/blog.html#mikrotik-vrrp Thu, 30 Jul 2026 00:00:00 GMT Two RouterOS boxes, one virtual gateway — VRRP so the LAN keeps its default gateway when a router dies, with priorities, preemption, and the interface-tracking trick that fails over on a dead WAN, not just a dead router. mikrotik routing https://s-markakis.github.io/blog.html#mikrotik-observability https://s-markakis.github.io/blog.html#mikrotik-observability Thu, 30 Jul 2026 00:00:00 GMT Make a RouterOS box tell you what it's doing — remote syslog, SNMPv3 monitoring, NTP so timestamps mean something, and Traffic-Flow (NetFlow/IPFIX) export to see what's actually on the wire. mikrotik monitoring https://s-markakis.github.io/blog.html#mikrotik-upgrades https://s-markakis.github.io/blog.html#mikrotik-upgrades Thu, 30 Jul 2026 00:00:00 GMT Update RouterOS without bricking a remote site — release channels, the two-part package-plus-RouterBOARD-firmware upgrade everyone forgets, backups before you touch it, and a clean rollback path. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-dot1x https://s-markakis.github.io/blog.html#mikrotik-dot1x Thu, 30 Jul 2026 00:00:00 GMT Require identity before a port passes traffic — RouterOS 7 dot1x server against a RADIUS backend, supplicant basics, and the fallback VLAN for devices that can't authenticate. mikrotik security https://s-markakis.github.io/blog.html#mikrotik-sniffer-mirror https://s-markakis.github.io/blog.html#mikrotik-sniffer-mirror Thu, 30 Jul 2026 00:00:00 GMT See the actual packets on RouterOS — the switch-chip port mirror for line-rate SPAN, the built-in /tool sniffer with quick-filters, and streaming capture straight into Wireshark over TZSP. mikrotik monitoring https://s-markakis.github.io/blog.html#mikrotik-ipv6 https://s-markakis.github.io/blog.html#mikrotik-ipv6 Thu, 30 Jul 2026 00:00:00 GMT Turn on IPv6 the right way on RouterOS — enabling the package, addressing and SLAAC, DHCPv6-PD to hand your ISP's prefix to the LAN, router advertisements, and an IPv6 firewall so you don't accidentally expose everything. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-fleet https://s-markakis.github.io/blog.html#mikrotik-fleet Thu, 30 Jul 2026 00:00:00 GMT Configure many RouterOS boxes without logging into each one — the RouterOS 7 REST API, the Ansible community.routeros collection, and a scripted config-push pattern that stays idempotent. mikrotik automation https://s-markakis.github.io/blog.html#attacking-mikrotik https://s-markakis.github.io/blog.html#attacking-mikrotik Thu, 30 Jul 2026 00:00:00 GMT The offensive companion to the RouterOS series: what an attacker actually does to a MikroTik — Winbox discovery and the CVE-2018-14847 credential leak, default-account and API exposure, bandwidth-test abuse, post-exploitation, and the one-line fix for each. mikrotik offensive security https://s-markakis.github.io/blog.html#cisco-field-hotel https://s-markakis.github.io/blog.html#cisco-field-hotel Thu, 30 Jul 2026 00:00:00 GMT An anonymised field write-up of a real collapsed-core Cisco build for a seaside hotel in Crete: VLAN segmentation for guests / PMS / CCTV / VoIP, dual-WAN failover with fibre primary and Starlink backup, guest isolation, and the three things that actually broke. cisco labs starlink https://s-markakis.github.io/blog.html#cisco-mikrotik-ipsec https://s-markakis.github.io/blog.html#cisco-mikrotik-ipsec Thu, 30 Jul 2026 00:00:00 GMT Build a working site-to-site IKEv2 IPsec tunnel between a Cisco IOS router and a MikroTik RouterOS box — the exact proposal matching, the route-based-vs-policy-based mismatch that breaks it, and NAT exemption on both ends. cisco mikrotik vpn https://s-markakis.github.io/blog.html#cisco-attacking-ios https://s-markakis.github.io/blog.html#cisco-attacking-ios Thu, 30 Jul 2026 00:00:00 GMT The offensive companion to the IOS series: what an attacker actually does to a Cisco switch or router — CDP/SNMP recon, Smart Install config theft, SNMP-RW config exfil, type-7/5/8/9 password cracking, and DTP/VTP Layer-2 abuse — with the one-line fix for each. cisco offensive security https://s-markakis.github.io/blog.html#cisco-site-to-site-vpn https://s-markakis.github.io/blog.html#cisco-site-to-site-vpn Thu, 30 Jul 2026 00:00:00 GMT Connect two offices over the internet securely — an IKEv2 route-based (VTI) IPsec tunnel on Cisco IOS: proposals, keyring, profile, tunnel interface, routing, and the NAT-exemption gotcha. cisco vpn https://s-markakis.github.io/blog.html#cisco-qos-voip https://s-markakis.github.io/blog.html#cisco-qos-voip Tue, 28 Jul 2026 00:00:00 GMT Make voice calls survive a busy link — DSCP marking, trust boundaries, LLQ priority queuing for RTP, and the class-based policy that keeps phones clear when the WAN is saturated. cisco routing https://s-markakis.github.io/blog.html#cisco-zbf https://s-markakis.github.io/blog.html#cisco-zbf Sun, 26 Jul 2026 00:00:00 GMT A real stateful firewall on an IOS router — zones, class-maps, policy-maps, zone-pairs, and stateful inspection. The stateful upgrade from stateless ACLs, built step by step. cisco security https://s-markakis.github.io/blog.html#cisco-ipsla-failover https://s-markakis.github.io/blog.html#cisco-ipsla-failover Fri, 24 Jul 2026 00:00:00 GMT Failover that detects a dead ISP even when the link stays up — IP SLA probes, track objects, tracked static routes, and NAT that follows the active WAN. cisco routing https://s-markakis.github.io/blog.html#cisco-hsrp https://s-markakis.github.io/blog.html#cisco-hsrp Wed, 22 Jul 2026 00:00:00 GMT A redundant gateway that survives a dead router — HSRP and VRRP explained: virtual IP, active/standby election, interface tracking, load sharing, and the preempt gotcha. cisco routing https://s-markakis.github.io/blog.html#cisco-stp-etherchannel https://s-markakis.github.io/blog.html#cisco-stp-etherchannel Mon, 20 Jul 2026 00:00:00 GMT Why one port is always blocking — spanning tree explained: root bridge election, Rapid PVST+, PortFast, and bundling redundant links into an LACP EtherChannel that uses them all. cisco switching https://s-markakis.github.io/blog.html#cisco-routing-ospf https://s-markakis.github.io/blog.html#cisco-routing-ospf Sat, 18 Jul 2026 00:00:00 GMT How a Cisco router chooses paths — reading the routing table, static and default routes, floating statics for failover, and single-area OSPF that maintains itself. cisco routing https://s-markakis.github.io/blog.html#cisco-switch-security https://s-markakis.github.io/blog.html#cisco-switch-security Thu, 16 Jul 2026 00:00:00 GMT Hardening Cisco access switches — port security and sticky MACs, err-disabled recovery, DHCP snooping, dynamic ARP inspection, BPDU guard, and unused-port hygiene. cisco switching https://s-markakis.github.io/blog.html#cisco-acls https://s-markakis.github.io/blog.html#cisco-acls Tue, 14 Jul 2026 00:00:00 GMT Filtering traffic on a Cisco router — standard vs extended ACLs, wildcard masks, named ACLs with sequence numbers, where to apply them, and protecting the VTY lines. cisco security https://s-markakis.github.io/blog.html#cisco-dhcp-nat https://s-markakis.github.io/blog.html#cisco-dhcp-nat Sun, 12 Jul 2026 00:00:00 GMT Hand out addresses and share one public IP on a Cisco router — DHCP pools and exclusions, DHCP relay, NAT concepts, PAT (overload) for the whole LAN, and static NAT for port forwarding. cisco fundamentals https://s-markakis.github.io/blog.html#cisco-backup-restore https://s-markakis.github.io/blog.html#cisco-backup-restore Fri, 10 Jul 2026 00:00:00 GMT Protect a Cisco config — save to startup, export to TFTP/SCP, automate with the archive feature and kron, roll back with configure replace, and recover a locked device. cisco fundamentals https://s-markakis.github.io/blog.html#cisco-vlans-trunking https://s-markakis.github.io/blog.html#cisco-vlans-trunking Wed, 08 Jul 2026 00:00:00 GMT Segmenting a Cisco switch network — access ports, 802.1Q trunks, the native VLAN, and inter-VLAN routing with router-on-a-stick and an L3 switch (SVI). cisco switching https://s-markakis.github.io/blog.html#cisco-first-contact https://s-markakis.github.io/blog.html#cisco-first-contact Mon, 06 Jul 2026 00:00:00 GMT Your first hour on a Cisco switch or router — the IOS CLI from scratch: console access, the three command modes, safe show commands, basic setup, and enabling SSH. cisco fundamentals https://s-markakis.github.io/blog.html#starlink-mikrotik-failover https://s-markakis.github.io/blog.html#starlink-mikrotik-failover Fri, 12 Jun 2026 00:00:00 GMT Multi-WAN failover on RouterOS v7 — keep a remote Starlink site online with recursive routing, connection marking, NAT, and netwatch health checks. mikrotik routing starlink https://s-markakis.github.io/blog.html#mikrotik-backup https://s-markakis.github.io/blog.html#mikrotik-backup Wed, 06 May 2026 00:00:00 GMT Export vs binary backup on MikroTik RouterOS — when to use which, how to automate both, and the full Netinstall recovery procedure. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-scripting https://s-markakis.github.io/blog.html#mikrotik-scripting Wed, 06 May 2026 00:00:00 GMT RouterOS scripting basics — variables, conditionals, loops, functions, and the scheduler, with WoL, Telegram alerts, and auto-backup examples. mikrotik automation https://s-markakis.github.io/blog.html#mikrotik-vlans https://s-markakis.github.io/blog.html#mikrotik-vlans Mon, 04 May 2026 00:00:00 GMT Configuring VLANs on MikroTik RouterOS — bridge VLAN filtering, tagging, and inter-VLAN routing. mikrotik switching https://s-markakis.github.io/blog.html#mikrotik-qos https://s-markakis.github.io/blog.html#mikrotik-qos Mon, 04 May 2026 00:00:00 GMT Quality of Service on MikroTik — queue trees, simple queues, and traffic prioritization. mikrotik routing https://s-markakis.github.io/blog.html#mikrotik-port-forwarding https://s-markakis.github.io/blog.html#mikrotik-port-forwarding Mon, 04 May 2026 00:00:00 GMT Setting up dst-nat port forwarding rules on MikroTik RouterOS for inbound services. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-wol https://s-markakis.github.io/blog.html#mikrotik-wol Mon, 04 May 2026 00:00:00 GMT Triggering Wake-on-LAN through MikroTik RouterOS — scripts, scheduling, and remote magic packets. mikrotik fundamentals https://s-markakis.github.io/blog.html#mikrotik-terminal https://s-markakis.github.io/blog.html#mikrotik-terminal Mon, 04 May 2026 00:00:00 GMT Useful RouterOS terminal commands and shortcuts for day-to-day MikroTik administration. mikrotik fundamentals https://s-markakis.github.io/blog.html#htb-authority https://s-markakis.github.io/blog.html#htb-authority Sun, 19 Apr 2026 00:00:00 GMT HackTheBox Authority machine walkthrough — full writeup with screenshots. offensive htb https://s-markakis.github.io/blog.html#htb-blurry https://s-markakis.github.io/blog.html#htb-blurry Sat, 11 Apr 2026 00:00:00 GMT HackTheBox Blurry machine walkthrough — full writeup with screenshots. offensive htb https://s-markakis.github.io/blog.html#htb-solarlab https://s-markakis.github.io/blog.html#htb-solarlab Sat, 11 Apr 2026 00:00:00 GMT HackTheBox SolarLab machine walkthrough — full writeup with screenshots. offensive htb https://s-markakis.github.io/blog.html#htb-freelancer https://s-markakis.github.io/blog.html#htb-freelancer Sat, 11 Apr 2026 00:00:00 GMT HackTheBox Freelancer machine walkthrough — full writeup with screenshots. offensive htb https://s-markakis.github.io/blog.html#htb-sandworm https://s-markakis.github.io/blog.html#htb-sandworm Sat, 11 Apr 2026 00:00:00 GMT HackTheBox Sandworm machine walkthrough — full writeup with screenshots. offensive htb